types

type ApparmorInspectOptions struct {
	Stdout io.Writer
}

type ApparmorListOptions struct {
	Stdout io.Writer
	// Only display profile names
	Quiet bool
	// Format the output using the given go template
	Format string
}

type BuilderBuildOptions struct {
	Stdin  io.Reader
	Stdout io.Writer
	Stderr io.Writer
	// GOptions is the global options
	GOptions GlobalCommandOptions
	// BuildKitHost is the buildkit host
	BuildKitHost string
	// Tag is the tag of the image
	Tag []string
	// File Name of the Dockerfile
	File string
	// Target is the target of the build
	Target string
	// BuildArgs is the build-time variables
	BuildArgs []string
	// NoCache disables cache
	NoCache bool
	// Output is the output destination
	Output string
	// Progress Set type of progress output (auto, plain, tty). Use plain to show container output
	Progress string
	// Secret file to expose to the build: id=mysecret,src=/local/secret
	Secret []string
	// Allow extra privileged entitlement, e.g. network.host, security.insecure
	Allow []string
	// Attestation parameters (format: "type=sbom,generator=image")"
	Attest []string
	// SSH agent socket or keys to expose to the build (format: default|<id>[=<socket>|<key>[,<key>]])
	SSH []string
	// Quiet suppress the build output and print image ID on success
	Quiet bool
	// CacheFrom external cache sources (eg. user/app:cache, type=local,src=path/to/dir)
	CacheFrom []string
	// CacheTo cache export destinations (eg. user/app:cache, type=local,dest=path/to/dir)
	CacheTo []string
	// Rm remove intermediate containers after a successful build
	Rm bool
	// Platform set target platform for build (e.g., "amd64", "arm64")
	Platform []string
	// IidFile write the image ID to the file
	IidFile string
	// Label is the metadata for an image
	Label []string
	// BuildContext is the build context
	BuildContext string
	// ExtendedBuildContext is a pair of key=value (e.g. myorg/myapp=docker-image://path/to/image, dir2=/path/to/dir2)
	ExtendedBuildContext []string
	// NetworkMode mode for the build context
	NetworkMode string
	// Pull determines if we should try to pull latest image from remote. Default is buildkit's default.
	Pull *bool
	// ExtraHosts is a set of custom host-to-IP mappings.
	ExtraHosts []string
}

type BuilderPruneOptions struct {
	Stderr io.Writer
	// GOptions is the global options
	GOptions GlobalCommandOptions
	// BuildKitHost is the buildkit host
	BuildKitHost string
	// All will remove all unused images and all build cache, not just dangling ones
	All bool
	// Force will not prompt for confirmation.
	Force bool
}

type CompressionType string

type ContainerAttachOptions struct {
	Stdin  io.Reader
	Stdout io.Writer
	Stderr io.Writer

	// GOptions is the global options.
	GOptions GlobalCommandOptions
	// DetachKeys is the key sequences to detach from the container.
	DetachKeys string
}

type ContainerCommitOptions struct {
	Stdout io.Writer
	// GOptions is the global options
	GOptions GlobalCommandOptions
	// Author (e.g., "nerdctl contributor <nerdctl-dev@example.com>")
	Author string
	// Commit message
	Message string
	// Apply Dockerfile instruction to the created image (supported directives: [CMD, ENTRYPOINT])
	Change []string
	// Pause container during commit
	Pause bool
	// Compression is set commit compression algorithm
	Compression CompressionType
	// Format specifies the image format for the committed image (docker or oci)
	Format ImageFormat
	// Embed EstargzOptions for eStargz conversion options
	EstargzOptions
	// Embed ZstdChunkedOptions for zstd:chunked conversion options
	ZstdChunkedOptions
}

type ContainerCpOptions struct {
	// GOptions is the global options.
	GOptions GlobalCommandOptions
	// ContainerReq is name, short ID, or long ID of container to copy to/from.
	ContainerReq   string
	Container2Host bool
	// Destination path to copy file to.
	DestPath string
	// Source path to copy file from.
	SrcPath string
	// Follow symbolic links in SRC_PATH
	FollowSymLink bool
}

type ContainerCreateOptions struct {
	Stdout io.Writer
	Stderr io.Writer
	// GOptions is the global options
	GOptions GlobalCommandOptions

	// NerdctlCmd is the command name of nerdctl
	NerdctlCmd string
	// NerdctlArgs is the arguments of nerdctl
	NerdctlArgs []string

	// InRun is true when it's generated in the `run` command
	InRun bool

	// #region for basic flags
	// Interactive keep STDIN open even if not attached
	Interactive bool
	// TTY specifies whether to allocate a pseudo-TTY for the container
	TTY bool
	// SigProxy specifies whether to proxy all received signals to the process
	SigProxy bool
	// Detach runs container in background and print container ID
	Detach bool
	// The key sequence for detaching a container.
	DetachKeys string
	// Attach STDIN, STDOUT, or STDERR
	Attach []string
	// Restart specifies the policy to apply when a container exits
	Restart string
	// Rm specifies whether to remove the container automatically when it exits
	Rm bool
	// Pull image before running, default is missing
	Pull string
	// Pid namespace to use
	Pid string
	// StopSignal signal to stop a container, default is SIGTERM
	StopSignal string
	// StopTimeout specifies the timeout (in seconds) to stop a container
	StopTimeout int

	// #region for platform flags
	// Platform set target platform for build (e.g., "amd64", "arm64", "windows", "freebsd")
	Platform string

	// #region for init process flags
	// InitProcessFlag specifies to run an init inside the container that forwards signals and reaps processes
	InitProcessFlag bool
	// InitBinary specifies the custom init binary to use, default is tini
	InitBinary *string

	// #region for isolation flags
	// Isolation specifies the container isolation technology
	Isolation string

	// #region for resource flags
	// CPUs specifies the number of CPUs
	CPUs float64
	// CPUQuota limits the CPU CFS (Completely Fair Scheduler) quota
	CPUQuota int64
	// CPUPeriod limits the CPU CFS (Completely Fair Scheduler) period
	CPUPeriod uint64
	// CPUShares specifies the CPU shares (relative weight)
	CPUShares uint64
	// CPUSetCPUs specifies the CPUs in which to allow execution (0-3, 0,1)
	CPUSetCPUs string
	// CPUSetMems specifies the memory nodes (MEMs) in which to allow execution (0-3, 0,1). Only effective on NUMA systems.
	CPUSetMems string
	// Limit CPU real-time period in microseconds
	CPURealtimePeriod uint64
	// Limit CPU real-time runtime in microseconds
	CPURealtimeRuntime uint64
	// Memory specifies the memory limit
	Memory string
	// MemoryReservationChanged specifies whether the memory soft limit has been changed
	MemoryReservationChanged bool
	// MemoryReservation specifies the memory soft limit
	MemoryReservation string
	// MemorySwap specifies the swap limit equal to memory plus swap: '-1' to enable unlimited swap
	MemorySwap string
	// MemSwappinessChanged specifies whether the memory swappiness has been changed
	MemorySwappiness64Changed bool
	// MemorySwappiness64 specifies the tune container memory swappiness (0 to 100) (default -1)
	MemorySwappiness64 int64
	// KernelMemoryChanged specifies whether the kernel memory limit has been changed
	KernelMemoryChanged bool
	// KernelMemory specifies the kernel memory limit(deprecated)
	KernelMemory string
	// OomKillDisable specifies whether to disable OOM Killer
	OomKillDisable bool
	// OomScoreAdjChanged specifies whether the OOM preferences has been changed
	OomScoreAdjChanged bool
	// OomScoreAdj specifies the tune container's OOM preferences (-1000 to 1000, rootless: 100 to 1000)
	OomScoreAdj int
	// PidsLimit specifies the tune container pids limit
	PidsLimit int64
	// CgroupConf specifies to configure cgroup v2 (key=value)
	CgroupConf []string
	// Cgroupns specifies the cgroup namespace to use
	Cgroupns string
	// CgroupParent specifies the optional parent cgroup for the container
	CgroupParent string
	// Device specifies add a host device to the container
	Device []string
	// CDIDevices specifies the CDI devices to add to the container
	CDIDevices []string

	// #region for blkio related flags
	// BlkioWeight specifies the block IO (relative weight), between 10 and 1000, or 0 to disable (default 0)
	BlkioWeight uint16
	// BlkioWeightDevice specifies the Block IO weight (relative device weight)
	BlkioWeightDevice []string
	// BlkioDeviceReadBps specifies the Block IO read rate limit(bytes per second) of a device
	BlkioDeviceReadBps []string
	// BlkioDeviceWriteBps specifies the Block IO write rate limit(bytes per second) of a device
	BlkioDeviceWriteBps []string
	// BlkioDeviceReadIOps specifies the Block IO read rate limit(IO per second) of a device
	BlkioDeviceReadIOps []string
	// BlkioDeviceWriteIOps specifies the Block IO read rate limit(IO per second) of a device
	BlkioDeviceWriteIOps []string

	// #region for intel RDT flags
	// RDTClass specifies the Intel Resource Director Technology (RDT) class
	RDTClass string

	// #region for user flags
	// User specifies the user to run the container as
	User string
	// Umask specifies the umask to use for the container
	Umask string
	// GroupAdd specifies additional groups to join
	GroupAdd []string

	// #region for security flags
	// SecurityOpt specifies security options
	SecurityOpt []string
	// CapAdd add Linux capabilities
	CapAdd []string
	// CapDrop drop Linux capabilities
	CapDrop []string
	// Privileged gives extended privileges to this container
	Privileged bool
	// Systemd
	Systemd string

	// #region for runtime flags
	// Runtime to use for this container, e.g. "crun", or "io.containerd.runsc.v1".
	Runtime string
	// Sysctl set sysctl options, e.g "net.ipv4.ip_forward=1"
	Sysctl []string

	// #region for volume flags
	// Volume specifies a list of volumes to mount
	Volume []string
	// Tmpfs specifies a list of tmpfs mounts
	Tmpfs []string
	// Mount specifies a list of mounts to mount
	Mount []string
	// VolumesFrom specifies a list of specified containers to mount from
	VolumesFrom []string

	// #region for rootfs flags
	// ReadOnly mount the container's root filesystem as read only
	ReadOnly bool
	// Rootfs specifies the first argument is not an image but the rootfs to the exploded container. Corresponds to Podman CLI.
	Rootfs bool

	// #region for env flags
	// EntrypointChanged specifies whether the entrypoint has been changed
	EntrypointChanged bool
	// Entrypoint overwrites the default ENTRYPOINT of the image
	Entrypoint []string
	// Workdir set the working directory for the container
	Workdir string
	// Env set environment variables
	Env []string
	// EnvFile set environment variables from file
	EnvFile []string

	// #region for metadata flags
	// Name assign a name to the container
	Name string
	// Label set meta data on a container
	// (not passed through to the OCI runtime since nerdctl v2.0, with an exception for "nerdctl/bypass4netns")
	Label []string
	// LabelFile read in a line delimited file of labels
	LabelFile []string
	// Annotations set meta data on a container (passed through to the OCI runtime)
	Annotations []string
	// CidFile write the container ID to the file
	CidFile string
	// PidFile specifies the file path to write the task's pid. The CLI syntax conforms to Podman convention.
	PidFile string

	// #region for logging flags
	// LogDriver set the logging driver for the container
	LogDriver string
	// LogOpt set logging driver specific options
	LogOpt []string

	// #region for shared memory flags
	// IPC namespace to use
	IPC string
	// ShmSize set the size of /dev/shm
	ShmSize string

	// #region for gpu flags
	// GPUs specifies GPU devices to add to the container ('all' to pass all GPUs). Please see also ./gpu.md for details.
	GPUs []string

	// #region for ulimit flags
	// Ulimit set ulimits
	Ulimit []string

	// #region for ipfs flags
	// IPFSAddress specifies the multiaddr of IPFS API (default uses $IPFS_PATH env variable if defined or local directory ~/.ipfs)
	IPFSAddress string

	// ImagePullOpt specifies image pull options which holds the ImageVerifyOptions for verifying the image.
	ImagePullOpt ImagePullOptions

	// Healthcheck related fields
	HealthCmd         string
	HealthInterval    time.Duration
	HealthTimeout     time.Duration
	HealthRetries     int
	HealthStartPeriod time.Duration
	NoHealthcheck     bool

	// UserNS name for user namespace mapping of container
	UserNS string
}

type ContainerDiffOptions struct {
	Stdout io.Writer
	// GOptions is the global options
	GOptions GlobalCommandOptions
}

type ContainerExecOptions struct {
	GOptions GlobalCommandOptions
	// Allocate a pseudo-TTY
	TTY bool
	// Keep STDIN open even if not attached
	Interactive bool
	// Detached mode: run command in the background
	Detach bool
	// Working directory inside the container
	Workdir string
	// Set environment variables
	Env []string
	// Set environment variables from file
	EnvFile []string
	// Give extended privileges to the command
	Privileged bool
	// Username or UID (format: <name|uid>[:<group|gid>])
	User string
}

type ContainerExportOptions struct {
	Stdout io.Writer
	// GOptions is the global options
	GOptions GlobalCommandOptions
}

type ContainerInspectOptions struct {
	Stdout io.Writer
	// GOptions is the global options
	GOptions GlobalCommandOptions
	// Format of the output
	Format string
	// Whether to report the size
	Size bool
	// Inspect mode, either dockercompat or native
	Mode string
}

type ContainerKillOptions struct {
	Stdout io.Writer
	Stderr io.Writer
	// GOptions is the global options
	GOptions GlobalCommandOptions
	// KillSignal is the signal to send to the container
	KillSignal string
}

type ContainerListOptions struct {
	// GOptions is the global options.
	GOptions GlobalCommandOptions
	// Show all containers (default shows just running).
	All bool
	// Show n last created containers (includes all states). Non-positive values are ignored.
	// In other words, if LastN is positive, All will be set to true.
	LastN int
	// Truncate output (e.g., container ID, command of the container main process, etc.) or not.
	Truncate bool
	// Display total file sizes.
	Size bool
	// Filters matches containers based on given conditions.
	Filters []string
}

type ContainerLogsOptions struct {
	Stdout io.Writer
	Stderr io.Writer
	// GOptions is the global options.
	GOptions GlobalCommandOptions
	// Follow specifies whether to stream the logs or just print the existing logs.
	Follow bool
	// Timestamps specifies whether to show the timestamps of the logs.
	Timestamps bool
	// Tail specifies the number of lines to show from the end of the logs.
	// Specify 0 to show all logs.
	Tail uint
	// Show logs since timestamp (e.g., 2013-01-02T13:23:37Z) or relative (e.g., 42m for 42 minutes).
	Since string
	// Show logs before a timestamp (e.g., 2013-01-02T13:23:37Z) or relative (e.g., 42m for 42 minutes).
	Until string
	// Details specifies whether to show extra details provided to logs
	Details bool
}

type ContainerPauseOptions struct {
	Stdout io.Writer
	// GOptions is the global options
	GOptions GlobalCommandOptions
}

type ContainerPruneOptions struct {
	Stdout io.Writer
	// GOptions is the global options
	GOptions GlobalCommandOptions
}

type ContainerRemoveOptions struct {
	Stdout io.Writer
	// GOptions is the global options
	GOptions GlobalCommandOptions
	// Force enables to remove a running|paused|unknown container (uses SIGKILL)
	Force bool
	// Volumes removes anonymous volumes associated with the container
	Volumes bool
}

type ContainerRenameOptions struct {
	Stdout io.Writer
	// GOptions is the global options
	GOptions GlobalCommandOptions
}

type ContainerRestartOptions struct {
	Stdout  io.Writer
	GOption GlobalCommandOptions
	// Time to wait after sending a SIGTERM and before sending a SIGKILL.
	Timeout *time.Duration
	// Signal to send to stop the container, before sending SIGKILL
	Signal string
}

type ContainerStartOptions struct {
	Stdout io.Writer
	// GOptions is the global options
	GOptions GlobalCommandOptions
	// Attach specifies whether to attach to the container's stdio.
	Attach bool
	// The key sequence for detaching a container.
	DetachKeys string
	// Attach stdin
	Interactive bool
}

type ContainerStatsOptions struct {
	Stdout io.Writer
	Stderr io.Writer
	// GOptions is the global options.
	GOptions GlobalCommandOptions
	// Show all containers (default shows just running).
	All bool
	// Pretty-print images using a Go template, e.g., {{json .}}.
	Format string
	// Disable streaming stats and only pull the first result.
	NoStream bool
	// Do not truncate output.
	NoTrunc bool
}

type ContainerStopOptions struct {
	Stdout io.Writer
	Stderr io.Writer
	// GOptions is the global options
	GOptions GlobalCommandOptions
	// Timeout specifies how long to wait after sending a SIGTERM and before sending a SIGKILL.
	// If it's nil, the default is 10 seconds.
	Timeout *time.Duration

	// Signal to send to the container, before sending SIGKILL
	Signal string
}

type ContainerTopOptions struct {
	Stdout io.Writer
	// GOptions is the global options
	GOptions GlobalCommandOptions

	// Arguments to pass through to the ps command
	PsArgs string
}

type ContainerUnpauseOptions ContainerPauseOptions

type ContainerWaitOptions struct {
	Stdout io.Writer
	// GOptions is the global options.
	GOptions GlobalCommandOptions
}

type EstargzOptions struct {
	// Estargz convert legacy tar(.gz) layers to eStargz for lazy pulling. Should be used in conjunction with '--oci'
	Estargz bool
	// EstargzRecordIn read 'ctr-remote optimize --record-out=<FILE>' record file (EXPERIMENTAL)
	EstargzRecordIn string
	// EstargzCompressionLevel eStargz compression level
	EstargzCompressionLevel int
	// EstargzChunkSize eStargz chunk size
	EstargzChunkSize int
	// EstargzMinChunkSize the minimal number of bytes of data must be written in one gzip stream. (requires stargz-snapshotter >= v0.13.0)
	EstargzMinChunkSize int
	// EstargzExternalToc separate TOC JSON into another image (called "TOC image"). The name of TOC image is the original + "-esgztoc" suffix. Both eStargz and the TOC image should be pushed to the same registry. (requires stargz-snapshotter >= v0.13.0) (EXPERIMENTAL)
	EstargzExternalToc bool
	// EstargzKeepDiffID convert to esgz without changing diffID (cannot be used in conjunction with '--estargz-record-in'. must be specified with '--estargz-external-toc')
	EstargzKeepDiffID bool
}

type GlobalCommandOptions config.Config

type IPFSRegistryServeOptions struct {
	// ListenRegistry address to listen
	ListenRegistry string
	// IPFSAddress multiaddr of IPFS API (default is pulled from $IPFS_PATH/api file. If $IPFS_PATH env var is not present, it defaults to ~/.ipfs)
	IPFSAddress string
	// ReadRetryNum times to retry query on IPFS. Zero or lower means no retry.
	ReadRetryNum int
	// ReadTimeout timeout duration of a read request to IPFS. Zero means no timeout.
	ReadTimeout time.Duration
}

type ImageConvertOptions struct {
	Stdout   io.Writer
	GOptions GlobalCommandOptions

	// #region generic flags
	// Uncompress convert tar.gz layers to uncompressed tar layers
	Uncompress bool
	// Oci convert Docker media types to OCI media types
	Oci bool

	// #region platform flags
	// Platforms convert content for a specific platform
	Platforms []string
	// AllPlatforms convert content for all platforms
	AllPlatforms bool

	// Format the output using the given Go template, e.g, 'json'
	Format string

	// Embed image format options
	EstargzOptions
	ZstdOptions
	ZstdChunkedOptions
	NydusOptions
	OverlaybdOptions
	SociConvertOptions
}

type ImageCryptOptions struct {
	Stdout   io.Writer
	GOptions GlobalCommandOptions
	// Platforms convert content for a specific platform
	Platforms []string
	// AllPlatforms convert content for all platforms
	AllPlatforms bool
	// GpgHomeDir the GPG homedir to use; by default gpg uses ~/.gnupg"
	GpgHomeDir string
	// GpgVersion the GPG version ("v1" or "v2"), default will make an educated guess
	GpgVersion string
	// Keys a secret key's filename and an optional password separated by colon;
	Keys []string
	// DecRecipients recipient of the image; used only for PKCS7 and must be an x509 certificate
	DecRecipients []string
	// Recipients of the image is the person who can decrypt it in the form specified above (i.e. jwe:/path/to/pubkey)
	Recipients []string
}

type ImageFormat string

type ImageImportOptions struct {
	Stdout   io.Writer
	Stdin    io.Reader
	GOptions GlobalCommandOptions

	Source    string
	Reference string
	Message   string
	Platform  string
}

type ImageInspectOptions struct {
	Stdout   io.Writer
	GOptions GlobalCommandOptions
	// Mode Inspect mode, "dockercompat" for Docker-compatible output, "native" for containerd-native output
	Mode string
	// Format the output using the given Go template, e.g, 'json'
	Format string
	// Platform inspect content for a specific platform
	Platform string
}

type ImageListOptions struct {
	Stdout io.Writer
	// GOptions is the global options
	GOptions GlobalCommandOptions
	// Quiet only show numeric IDs
	Quiet bool
	// NoTrunc don't truncate output
	NoTrunc bool
	// Format the output using the given Go template, e.g, '{{json .}}', 'wide'
	Format string
	// Filter output based on conditions provided, for the --filter argument
	Filters []string
	// NameAndRefFilter filters images by name and reference
	NameAndRefFilter []string
	// Digests show digests (compatible with Docker, unlike ID)
	Digests bool
	// Names show image names
	Names bool
	// All (unimplemented yet, always true)
	All bool
}

type ImageLoadOptions struct {
	Stdout   io.Writer
	Stdin    io.Reader
	GOptions GlobalCommandOptions
	// Input read from tar archive file, instead of STDIN
	Input string
	// Platform import content for a specific platform
	Platform []string
	// AllPlatforms import content for all platforms
	AllPlatforms bool
	// Quiet suppresses the load output.
	Quiet bool
}

type ImagePruneOptions struct {
	Stdout io.Writer
	// GOptions is the global options.
	GOptions GlobalCommandOptions
	// All Remove all unused images, not just dangling ones.
	All bool
	// Filters output based on conditions provided for the --filter argument
	Filters []string
	// Force will not prompt for confirmation.
	Force bool
}

type ImagePullOptions struct {
	Stdout io.Writer
	Stderr io.Writer
	// ProgressOutputToStdout directs progress output to stdout instead of stderr
	ProgressOutputToStdout bool

	GOptions      GlobalCommandOptions
	VerifyOptions ImageVerifyOptions
	// Unpack the image for the current single platform.
	// If nil, it will unpack automatically if only 1 platform is specified.
	Unpack *bool
	// Content for specific platforms. Empty if `--all-platforms` is true
	OCISpecPlatform []ocispec.Platform
	// Pull mode
	Mode string
	// Suppress verbose output
	Quiet bool
	// multiaddr of IPFS API (default uses $IPFS_PATH env variable if defined or local directory ~/.ipfs)
	IPFSAddress string
	// Flags to pass into remote snapshotters
	RFlags RemoteSnapshotterFlags
}

type ImagePushOptions struct {
	Stdout      io.Writer
	GOptions    GlobalCommandOptions
	SignOptions ImageSignOptions
	SociOptions SociOptions
	// Platforms convert content for a specific platform
	Platforms []string
	// AllPlatforms convert content for all platforms
	AllPlatforms bool

	// Estargz convert image to sStargz
	Estargz bool
	// IpfsEnsureImage ensure image is pushed to IPFS
	IpfsEnsureImage bool
	// IpfsAddress multiaddr of IPFS API (default uses $IPFS_PATH env variable if defined or local directory ~/.ipfs)
	IpfsAddress string
	// Suppress verbose output
	Quiet bool
	// AllowNondistributableArtifacts allow pushing non-distributable artifacts
	AllowNondistributableArtifacts bool
}

type ImageRemoveOptions struct {
	Stdout io.Writer
	// GOptions is the global options
	GOptions GlobalCommandOptions
	// Force removal of the image
	Force bool
	// Async asynchronous mode or not
	Async bool
}

type ImageSaveOptions struct {
	Stdout   io.Writer
	GOptions GlobalCommandOptions
	// Export content for all platforms
	AllPlatforms bool
	// Export content for a specific platform
	Platform []string
}

type ImageSignOptions struct {
	// Provider used to sign the image (none|cosign|notation)
	Provider string
	// CosignKey Path to the private key file, KMS URI or Kubernetes Secret for --sign=cosign
	CosignKey string
	// NotationKeyName Signing key name for a key previously added to notation's key list for --sign=notation
	NotationKeyName string
}

type ImageTagOptions struct {
	// GOptions is the global options
	GOptions GlobalCommandOptions
	// Source is the image to be referenced.
	Source string
	// Target is the image to be created.
	Target string
}

type ImageVerifyOptions struct {
	// Provider used to verify the image (none|cosign|notation)
	Provider string
	// CosignKey Path to the public key file, KMS URI or Kubernetes Secret for --verify=cosign
	CosignKey string
	// CosignCertificateIdentity The identity expected in a valid Fulcio certificate for --verify=cosign. Valid values include email address, DNS names, IP addresses, and URIs. Either --cosign-certificate-identity or --cosign-certificate-identity-regexp must be set for keyless flows
	CosignCertificateIdentity string
	// CosignCertificateIdentityRegexp A regular expression alternative to --cosign-certificate-identity for --verify=cosign. Accepts the Go regular expression syntax described at https://golang.org/s/re2syntax. Either --cosign-certificate-identity or --cosign-certificate-identity-regexp must be set for keyless flows
	CosignCertificateIdentityRegexp string
	// CosignCertificateOidcIssuer The OIDC issuer expected in a valid Fulcio certificate for --verify=cosign, e.g. https://token.actions.githubusercontent.com or https://oauth2.sigstore.dev/auth. Either --cosign-certificate-oidc-issuer or --cosign-certificate-oidc-issuer-regexp must be set for keyless flows
	CosignCertificateOidcIssuer string
	// CosignCertificateOidcIssuerRegexp A regular expression alternative to --certificate-oidc-issuer for --verify=cosign. Accepts the Go regular expression syntax described at https://golang.org/s/re2syntax. Either --cosign-certificate-oidc-issuer or --cosign-certificate-oidc-issuer-regexp must be set for keyless flows
	CosignCertificateOidcIssuerRegexp string
}

type LoginCommandOptions struct {
	// GOptions is the global options.
	GOptions GlobalCommandOptions
	// ServerAddress is the server address to log in to.
	ServerAddress string
	// Username is the username to log in as.
	//
	// If it's empty, it will be inferred from the default auth config.
	// If nothing is in the auth config, the user will be prompted to provide it.
	Username string
	// Password is the password of the user.
	//
	// If it's empty, the user will be prompted to provide it.
	Password string
}

type ManifestAnnotateOptions struct {
	Stdout     io.Writer
	GOptions   GlobalCommandOptions
	Os         string
	Arch       string
	OsVersion  string
	Variant    string
	OsFeatures []string
}

type ManifestCreateOptions struct {
	Stdout   io.Writer
	GOptions GlobalCommandOptions
	// Amend an existing manifest list
	Amend bool
	// Allow communication with an insecure registry
	Insecure bool
}

type ManifestInspectOptions struct {
	Stdout   io.Writer
	GOptions GlobalCommandOptions
	// Verbose output additional info including layers and platform
	Verbose bool
	// Allow communication with an insecure registry
	Insecure bool
}

type ManifestPushOptions struct {
	Stdout   io.Writer
	GOptions GlobalCommandOptions
	// Allow communication with an insecure registry
	Insecure bool
	// Remove the manifest list after pushing
	Purge bool
}

type NamespaceCreateOptions struct {
	GOptions GlobalCommandOptions
	// Labels are the namespace labels
	Labels []string
}

type NamespaceInspectOptions struct {
	Stdout   io.Writer
	GOptions GlobalCommandOptions
	// Format the output using the given Go template, e.g, '{{json .}}'
	Format string
}

type NamespaceListOptions struct {
	Stdout   io.Writer
	GOptions GlobalCommandOptions
	// Format the output using the given Go template, e.g, '{{json .}}'
	Format string
	// Quiet suppresses extra information and only prints namespace names
	Quiet bool
}

type NamespaceRemoveOptions struct {
	Stdout   io.Writer
	GOptions GlobalCommandOptions
	// CGroup delete the namespace's cgroup
	CGroup bool
}

type NamespaceUpdateOptions NamespaceCreateOptions

type NetworkCreateOptions struct {
	// GOptions is the global options
	GOptions GlobalCommandOptions

	Name        string
	Driver      string
	Options     map[string]string
	IPAMDriver  string
	IPAMOptions map[string]string
	Subnets     []string
	Gateway     string
	IPRange     string
	Labels      []string
	IPv6        bool
	Internal    bool
}

type NetworkInspectOptions struct {
	Stdout io.Writer
	// GOptions is the global options
	GOptions GlobalCommandOptions
	// Inspect mode, "dockercompat" for Docker-compatible output, "native" for containerd-native output
	Mode string
	// Format the output using the given Go template, e.g, '{{json .}}'
	Format string
	// Networks are the networks to be inspected
	Networks []string
}

type NetworkListOptions struct {
	Stdout io.Writer
	// GOptions is the global options
	GOptions GlobalCommandOptions
	// Quiet only show numeric IDs
	Quiet bool
	// Format the output using the given Go template, e.g, '{{json .}}', 'wide'
	Format string
	// Filter matches network based on given conditions
	Filters []string
}

type NetworkOptions struct {
	// NetworkSlice specifies the networking mode for the container, default is "bridge"
	NetworkSlice []string
	// MACAddress set container MAC address (e.g., 92:d0:c6:0a:29:33)
	MACAddress string
	// IPAddress set specific static IP address(es) to use
	IPAddress string
	// IP6Address set specific static IP6 address(es) to use
	IP6Address string
	// Hostname set container host name
	Hostname string
	// Domainname specifies the container's domain name
	Domainname string
	// DNSServers set custom DNS servers
	DNSServers []string
	// DNSResolvConfOptions set DNS options
	DNSResolvConfOptions []string
	// DNSSearchDomains set custom DNS search domains
	DNSSearchDomains []string
	// AddHost add a custom host-to-IP mapping (host:ip)
	AddHost []string
	// UTS namespace to use
	UTSNamespace string
	// PortMappings specifies a list of ports to publish from the container to the host
	PortMappings []cni.PortMapping
}

type NetworkPruneOptions struct {
	Stdout io.Writer
	// GOptions is the global options
	GOptions GlobalCommandOptions
	// Network drivers to keep while pruning
	NetworkDriversToKeep []string
}

type NetworkRemoveOptions struct {
	Stdout io.Writer
	// GOptions is the global options
	GOptions GlobalCommandOptions
	// Networks are the networks to be removed
	Networks []string
}

type NydusOptions struct {
	// Nydus convert legacy tar(.gz) layers to nydus for lazy pulling. Should be used in conjunction with '--oci'
	Nydus bool
	// NydusBuilderPath the nydus-image binary path, if unset, search in PATH environment
	NydusBuilderPath string
	// NydusWorkDir work directory path for image conversion, default is the nerdctl data root directory
	NydusWorkDir string
	// NydusPrefetchPatterns the file path pattern list want to prefetch
	NydusPrefetchPatterns string
	// NydusCompressor nydus blob compression algorithm, possible values: `none`, `lz4_block`, `zstd`, default is `lz4_block`
	NydusCompressor string
}

type OverlaybdOptions struct {
	// Overlaybd convert tar.gz layers to overlaybd layers
	Overlaybd bool
	// OverlayFsType filesystem type for overlaybd
	OverlayFsType string
	// OverlaydbDBStr database config string for overlaybd
	OverlaydbDBStr string
}

type RemoteSnapshotterFlags struct {
	SociIndexDigest string
}

type SociConvertOptions struct {
	// Soci convert image to SOCI format.
	Soci bool
	// SociOptions contains SOCI-specific options
	SociOptions SociOptions
}

type SociOptions struct {
	// Span size that soci index uses to segment layer data. Default is 4 MiB.
	SpanSize int64
	// Minimum layer size to build zTOC for. Smaller layers won't have zTOC and not lazy pulled. Default is 10 MiB.
	MinLayerSize int64
	// Platforms convert content for a specific platform
	Platforms []string
	// AllPlatforms convert content for all platforms
	AllPlatforms bool
}

type SystemEventsOptions struct {
	Stdout io.Writer
	// GOptions is the global options
	GOptions GlobalCommandOptions
	// Format the output using the given Go template, e.g, '{{json .}}
	Format string
	// Filter events based on given conditions
	Filters []string
}

type SystemInfoOptions struct {
	Stdout io.Writer
	Stderr io.Writer
	// GOptions is the global options
	GOptions GlobalCommandOptions
	// Information mode, "dockercompat" for Docker-compatible output, "native" for containerd-native output
	Mode string
	// Format the output using the given Go template, e.g, '{{json .}}
	Format string
}

type SystemPruneOptions struct {
	Stdout io.Writer
	Stderr io.Writer
	// GOptions is the global options
	GOptions GlobalCommandOptions
	// All remove all unused images, not just dangling ones
	All bool
	// Volumes decide whether prune volumes or not
	Volumes bool
	// BuildKitHost the address of BuildKit host
	BuildKitHost string
	// NetworkDriversToKeep the network drivers which need to keep
	NetworkDriversToKeep []string
}

type VolumeCreateOptions struct {
	Stdout   io.Writer
	GOptions GlobalCommandOptions
	// Labels are the volume labels
	Labels []string
}

type VolumeInspectOptions struct {
	Stdout   io.Writer
	GOptions GlobalCommandOptions
	// Format the output using the given go template
	Format string
	// Display the disk usage of volumes. Can be slow with volumes having loads of directories.
	Size bool
}

type VolumeListOptions struct {
	Stdout   io.Writer
	GOptions GlobalCommandOptions
	// Only display volume names
	Quiet bool
	// Format the output using the given go template
	Format string
	// Display the disk usage of volumes. Can be slow with volumes having loads of directories.
	Size bool
	// Filter matches volumes based on given conditions
	Filters []string
}

type VolumePruneOptions struct {
	Stdout   io.Writer
	GOptions GlobalCommandOptions
	//Remove all unused volumes, not just anonymous ones
	All bool
	// Do not prompt for confirmation
	Force bool
}

type VolumeRemoveOptions struct {
	Stdout   io.Writer
	GOptions GlobalCommandOptions
	// Force the removal of one or more volumes
	Force bool
}

type ZstdChunkedOptions struct {
	// ZstdChunked convert legacy tar(.gz) layers to zstd:chunked for lazy pulling. Should be used in conjunction with '--oci'
	ZstdChunked bool
	// ZstdChunkedCompressionLevel zstd compression level
	ZstdChunkedCompressionLevel int
	// ZstdChunkedChunkSize zstd chunk size
	ZstdChunkedChunkSize int
	// ZstdChunkedRecordIn read 'ctr-remote optimize --record-out=<FILE>' record file (EXPERIMENTAL)
	ZstdChunkedRecordIn string
}

type ZstdOptions struct {
	// Zstd convert legacy tar(.gz) layers to zstd. Should be used in conjunction with '--oci'
	Zstd bool
	// ZstdCompressionLevel zstd compression level
	ZstdCompressionLevel int
}